CVE-2025-15661

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 commit 2dae302

Description An out-of-bounds heap read exists in the sftp symlink() function within src/sftp.c. A malicious SSH server or man-in-the-middle attacker can disclose heap memory contents or cause a crash by sending a crafted SSH FXP NAME response. This occurs because the software fails to validate the available packet buffer size before a memcpy operation, allowing an attacker to supply a link len value larger than the actual packet data during SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target len minus one bytes.

Recommendations Update to the version containing commit 2dae302 to resolve the issue.